CVE-2026-100533 in OpenClaw
Summary
by MITRE • 09/26/2026
OpenClaw versions before 2026.8.1 contain a path traversal vulnerability in the tools.fs.workspaceOnly feature where Unicode filename fallback can normalize validated parent directory components. Admitted requesters can exploit canonically equivalent sibling directories to read files outside the configured workspace boundary.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in OpenClaw versions prior to 2026.8.1 represents a critical path traversal flaw rooted in improper handling of Unicode filename normalization within the tools.fs.workspaceOnly feature. This security defect allows attackers who have admitted access to the application to bypass configured workspace boundaries, effectively escaping the intended sandbox environment. The core technical issue lies in how the system processes file paths that contain non-ASCII characters or complex Unicode sequences. When a request involves such filenames, the underlying filesystem logic attempts to normalize these names by falling back to canonical equivalents for compatibility and consistency. However, this normalization process fails to adequately validate whether the resulting canonical path remains within the permitted workspace directory structure.
Specifically, an attacker can craft requests using canonically equivalent sibling directories that appear distinct in their raw Unicode form but resolve to paths outside the allowed scope after normalization. For instance, by utilizing specific Unicode composition forms or combining characters, a requester can construct a file path that initially passes initial validation checks because it appears to reside within the workspace. Once processed by the filesystem layer, however, the fallback mechanism resolves these components into their canonical byte representations, which may point to parent directories or entirely different branches of the directory tree. This discrepancy between pre-validation and post-normalization states creates a window for exploitation where the application grants access to sensitive files that should remain isolated from the user's workspace context.
The operational impact of this vulnerability is severe, as it compromises the integrity of data isolation mechanisms designed to protect multi-tenant environments or restricted development spaces. Admitted requesters can read arbitrary files on the host system, potentially exposing confidential source code, configuration secrets, database credentials, or other sensitive information stored outside the designated workspace boundary. This escape from sandboxing undermines trust in the platform's security model and could lead to further lateral movement if combined with other vulnerabilities such as server-side request forgery or local privilege escalation techniques. The ability to read files beyond authorized limits constitutes a direct violation of confidentiality requirements, impacting both individual user data privacy and organizational compliance postures.
From an industry standard perspective, this vulnerability aligns closely with CWE-22: Improper Limitation of a Pathname to a Restricted Directory, commonly known as path traversal or directory traversal. The specific mechanism involving Unicode normalization issues also relates to CWE-184: Incomplete List of Inputs, where the system fails to account for all possible representations of input data that could lead to unintended behavior. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework, this exploitation technique falls under T1083: File and Directory Discovery, as it enables unauthorized enumeration and access to restricted file systems. It may also be categorized under T1564.002: Hidden Files and Directories if the attacker uses these techniques to obscure their activity or access hidden system files.
Mitigation strategies must focus on enforcing strict path validation at multiple layers of the application stack. The most effective immediate fix is upgrading OpenClaw to version 2026.8.1 or later, where this normalization flaw has been addressed by developers through improved canonicalization logic that ensures consistency between pre-validation and post-processing states. For environments unable to upgrade immediately, administrators should implement robust input sanitization routines that reject any file paths containing Unicode characters requiring complex fallback handling unless explicitly whitelisted. Additionally, deploying a web application firewall with rules specifically tuned for path traversal patterns involving encoded or unusual character sequences can provide an additional layer of defense. It is also recommended to configure the underlying operating system and filesystem permissions using least privilege principles, ensuring that even if a bypass occurs, the process running OpenClaw lacks read access to critical directories outside its designated scope. Regular security audits focusing on file I/O operations and Unicode handling in similar systems are essential to prevent recurrence of such normalization-based escape vulnerabilities.